Add caddy-l4 plugin to xcaddy build to enable TCP-level routing.
Configure a layer4 listener on port 2222 that proxies all connections
to gitea.srv.renner.uno:22, enabling SSH git operations via the
Caddy ingress VIP without conflicting with system SSH on port 22.
ansible.cfg inventory and vault_password_file paths were pointing to
~/homelab which was the path on fortress. Updated to ~/source/homelab
to work from workstation after cloning the repo locally.
The /audiobooks and /metadata directories were owned by root,
preventing the audiobookshelf service from creating new directories
for uploads. This playbook sets correct ownership to audiobookshelf user.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
The NetBird PKCE flow was sending prompt=login in the OAuth authorization
request, which caused Authentik to force re-authentication even after the
user had already authenticated. This resulted in users seeing two identical
login prompts before the desktop client callback was reached.
Setting DisablePromptLogin: true prevents the prompt=login parameter from
being sent, allowing Authentik to use the existing session.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
VMs should use kvm-clock from hypervisor, and LXC containers inherit
time from the host. Running systemd-timesyncd is unnecessary and can
cause time sync conflicts.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
VMs should get time from the hypervisor via kvm-clock, not run their
own NTP client. This prevents unnecessary NTP traffic and ensures
consistent time across all VMs.
Added to common role with condition: ansible_virtualization_type == 'kvm'
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
- Configure chrony_exporter to run as _chrony user for unix socket access
- Enable serverstats collector for NTP request statistics
- Add ReadWritePaths=/run/chrony for systemd security compatibility
- Add cmdallow 127.0.0.1 to chrony config for UDP command access
- Update NTP Overview dashboard with server statistics:
- Total NTP requests counter
- Dropped NTP requests counter
- Command packets counter
- NTP request rate time series
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
Added chrony_exporter lesson: always read the README before attempting
workarounds. The docs clearly stated UDP is default and unix socket
requires root.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
- Add chrony-exporter role to install and configure chrony_exporter
- Update chrony-ntp-server to use UDP command interface (port 323) instead of unix socket for easier exporter access
- Add chrony job to Prometheus scrape config
- Update NTP Overview dashboard with stratum panels for jupiter/saturn/neptune
- Add timex collector to node_exporter on PVE hosts
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
- Install node_exporter with timex collector on PVE cluster (jupiter, saturn, neptune)
- Add PVE hosts as Prometheus scrape targets for NTP metrics
- Update NTP Overview dashboard to show actual cluster status
- Add install-node-exporter-pve.yml playbook for PVE deployment
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
Add new dashboard for monitoring NTP/time synchronization across the infrastructure:
- NTP HA cluster status panels for DNS-1, DNS-2, DNS-3
- Hosts synchronized/not synced counters
- Average time offset stat
- Time offset history graphs for NTP cluster and all hosts
- Detailed table with host sync status, offset, and max error
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
VMs should get time from Proxmox host via kvm-clock instead of
running their own NTP client. This playbook:
- Detects VMs using kvm-clock
- Disables and masks systemd-timesyncd
- LXC containers already inherit host time automatically
Usage: ansible-playbook plays/configure-vm-time-sync.yml
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
Discovers all Shelly devices on IoT networks via HTTP API and
configures them to use the local HA NTP server (ntp.renner.uno).
Supports:
- Gen1 devices (via /settings endpoint)
- Gen2/Gen3/Gen4 devices (via /rpc/Sys.SetConfig endpoint)
Usage: ansible-playbook plays/configure-shelly-ntp.yml
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
Switch from Debian pool to PTB (Physikalisch-Technische Bundesanstalt)
atomic clock servers for more accurate time synchronization:
- ptbtime1.ptb.de (preferred)
- ptbtime2.ptb.de
- ptbtime3.ptb.de
Keeps de.pool.ntp.org as fallback.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
Deploy chrony NTP servers on all 3 PVE hosts (jupiter, saturn, neptune)
with keepalived VIP failover at 10.2.40.4.
- chrony-ntp-server role: Configures chrony to serve NTP to local networks
- keepalived-ntp role: Manages VIP failover with NTP health checks
- install-ntp-ha.yml: Deployment playbook for the HA cluster
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
Add Ansible task to create the .stfolder marker in the consume directory
when Syncthing is enabled. This prevents sync failures when the marker
gets accidentally deleted.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
- Changed from single battery_power sensor (unsigned) to separate
battery_power_in_absolute and battery_power_out_absolute sensors
- battery_power_out_absolute correctly shows discharge power
- battery_power_in_absolute correctly shows charge power
- Updated timeseries panel to use out - in for signed battery power
- This fixes the incorrect battery values shown in the flow diagram
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
Replace Sankey panel with Business Charts (ECharts) plugin for creating
custom power flow visualization with:
- Circular nodes for Solar, Grid, Battery, Home
- Animated flow dots showing energy direction
- Color-coded connections based on power source/destination
- Real-time power values and battery SOC display
Also adds grafana host to static inventory for reliable deployments.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
- Add LXC container configuration (ID 230, 4GB RAM, 2 cores)
- Create Ansible role with Docker Compose deployment
- Configure PostgreSQL database for production reliability
- Add reverse proxy configuration in Caddy HA
- Store secrets (encryption key, DB password) in Ansible vault
n8n v2.11.0 accessible at https://n8n.renner.uno🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
Install netsage-sankey-panel plugin and update power flow dashboard to
use it for visualizing energy flow from sources (Solar, Grid, Battery)
to destinations (Home consumption by floor).
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
The Grafana flowcharting plugin is Angular-based and incompatible with
Grafana 12. This replaces it with an embedded SVG in a Text panel showing
power flow visualization (Solar, Grid, Battery, Home) with colored nodes
and flow lines.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
- Add agenty-flowcharting-panel plugin installation task
- Create draw.io-based energy flow diagram with:
- Solar, Grid, Battery, Home nodes as circles
- Colored flow lines connecting nodes
- Data bindings for live power values
- Add floor breakdown and large consumers side panels
- Matching colors: Solar(amber), Grid(blue), Battery(green), Home(orange)
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
- Fix Solar field reference from "Value" to "Value #A"
- Fix House calculation to sum floor power consumption instead of
complex clamp_min formula that returned no data
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
Update power-flow dashboard with:
- Canvas panel showing graphical flow from sources to sinks
- Visual connections between Solar/Grid/Battery and House
- Visual connections from House to floor-level consumers (KG/EG/OG/DG)
- Large consumers section with Server, Heat Pump, Battery Charging, Garden
- Color-coded elements matching the flow colors
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
Creates a comprehensive power flow dashboard showing:
Sources:
- Solar production (Vitocharge 03)
- Grid import/export
- Battery level and charge/discharge status
Sinks by Floor:
- KG (Keller) with server breakdown
- EG (Erdgeschoss) room breakdown
- OG (Obergeschoss) room breakdown
- DG (Dachgeschoss) room breakdown
Large Consumers:
- Server
- Battery charging
- Heat pump
- Garden
Historical Charts:
- Power flow over time (solar, battery, grid, house)
- Floor consumption history
Energy Statistics:
- Solar production today/total
- Grid import/export totals
- Self-consumption percentage
- Heat pump energy this year
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
- Use HTTP challenge instead of TLS challenge for ACME
- Set explicit Docker network for Traefik provider
- Add proxy state volume for persistence
- Use traefik:latest image
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
Per NetBird documentation, the proxy domain must NOT be a subdomain
of the management domain as this causes TLS and routing conflicts.
Changed from proxy.netbird.renner.uno to proxy.renner.uno.
Also added NB_PROXY_DEBUG=true for troubleshooting.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
Implemented reverse proxy feature exactly as per NetBird docs:
- Added netbird-proxy service with TLS passthrough via Traefik
- Created proxy.env configuration for ACME certificates
- Added AuthClientID and AuthCallbackURL to management.json (required for external IdP)
- Generated new proxy token and stored in vault
DNS records already configured:
- proxy.netbird.renner.uno -> netbird.renner.uno
- *.proxy.netbird.renner.uno -> netbird.renner.uno
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
Changed from Docker named volumes to bind mounts pointing to
/opt/netbird/management, /opt/netbird/signal, and /opt/netbird/letsencrypt
to ensure the existing database is preserved across deployments.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
Update NetBird server configuration to match the official
infrastructure_files/docker-compose.yml.tmpl for external IdP setups.
Changes:
- Management port: 443 -> 33073 (official standard)
- Signal gRPC port: 80 -> 10000
- Relay port: 80 -> 33080
- Add ws-proxy routes for signal and management
- Use Docker volumes instead of host directories
- Rename container to netbird-traefik
- Remove ReverseProxy config from management.json
- Add structured logging to all containers
- Clean up Traefik config with global HTTP redirect
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
Remove NetBird reverse proxy configuration that was causing TLS/ACME
issues. The proxy feature requires additional configuration that
conflicts with Traefik's ACME TLS challenge handling.
Removed:
- proxy container from docker-compose
- proxy.env template and deployment task
- proxy-related variables from defaults
- proxy handler
- project plan file
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
The proxy domain must not be a subdomain of the management domain
(netbird.renner.uno). Changed from proxy.netbird.renner.uno to
proxy.renner.uno per NetBird documentation requirements.
Also added project plan for exposing services via NetBird reverse proxy.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
HA documentation feature moved to separate project for further development.
See ~/Notes/Work & Dev/Projects/HA Wiki Documentation.md
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
- Use WebSocket API for area, device, and entity registries
- Generate per-room documentation pages with devices, entities, and automations
- Group entities by domain (lights, switches, sensors, etc.)
- Match automations to rooms by name pattern
- Add websocket-client dependency
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
- Add generate-ha-docs.py script to query HA API
- Generate docs for entities, automations, scripts, scenes, devices, integrations
- Auto-regenerate HA docs every 15 minutes via cron
- Add HA token to vault
- Update mkdocs.yml navigation with HA Auto section
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
- Add encryption password and API key support
- Fix volume mount paths with spaces
- Add CRON_BACKUP_ONLY mode
- Configure nas-1 backup paths and PBS server
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
- Add snmp-exporter role with Synology module support
- Add Synology scrape job to Prometheus config
- Add Synology NAS Grafana dashboard
- Support SNMPv2/v3 authentication
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
- Add raw syslog format support for BSD/RFC 3164 style logs
- Parse hostname and app from Synology log messages
- Configure loki.srv.renner.uno as syslog receiver (UDP 1514)
- Add stability_level experimental for raw format support
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
- Add MkDocs wiki LXC (235) on saturn
- Create mkdocs-wiki Ansible role with:
- MkDocs Material theme
- Obsidian wikilinks support (roamlinks plugin)
- Multi-language support (i18n plugin)
- Caddy for local serving
- Sync script for updates
- Add wiki.renner.uno route to Caddy HA
Source: Obsidian vault at ~/Notes/Work & Dev/Homelab
Renders documentation for household members at wiki.renner.uno
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
Update CLAUDE.md to use the docs-maintainer Task agent for
documentation updates in ~/Notes Obsidian vault.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
k.renner
